root - chore: upgrade ejs to v6 (breaking)

[jaredwray]

Summary

Upgrade the EJS template engine across a major version. First runtime-phase PR.

Versions

• ejs 5.0.2 → 6.0.1

Tests

• pnpm build passes
• pnpm test passes (239 tests, 100% coverage) — no code changes required

Breaking notes

ejs 6 is primarily a packaging + security major; ecto's EJS engine uses the stable ejs.render(source, data, opts) API, which is unchanged.

• Dual ESM/CJS packaging: ejs now ships proper separate lib/esm and lib/cjs builds. The old dual-mode shim (module.exports = ejs inside the ESM source) that modern ESM bundlers / Bun / Deno treated as malformed has been removed. This is strictly better for ecto, which is an ESM-only package.
• Prototype-pollution mitigation (new default): template identifiers no longer resolve through the locals object's prototype chain. Consumers who pass class instances / Object.create(...) locals and rely on inherited top-level properties must now opt in via the new unsafePrototypeLocals: true option. ecto's typical plain-object locals are unaffected.

Notes

Runtime-phase ordering: writr 6.1.3 (higher priority, patch) is deferred — the repo's trustPolicy: no-downgrade rejects writr@6.1.2/6.1.3 (pulled transitively by docula@2.0.0) because earlier writr versions carried provenance attestation and these don't. Reported separately; not bundled here.

🤖 Generated with Claude Code

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ejs@​6.0.1

View full report

[gemini-code-assist]

Code Review

This pull request updates the ejs dependency from version ^5.0.2 to ^6.0.1 in package.json and updates the pnpm-lock.yaml file accordingly. There are no review comments, and I have no feedback to provide.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (a879f9c) to head (5f9bba4).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #384   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            9         9           
  Lines          409       409           
  Branches        96        96           
=========================================
  Hits           409       409           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.